Subject: [spfbis] [Technical Errata Reported] RFC7208 (4081)

From: RFC Errata System <[email-masked]>
Date: Wed, 13 Aug 2014 16:07:34 -0700 (PDT)

The following errata report has been submitted for RFC7208,
"Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=7208&eid=4081

--------------------------------------
Type: Technical
Reported by: D. Stussy <[email-masked]>

Section: 8.4

Original Text
-------------
(Paragraph 2):  if supported, the 5.7.1 enhanced status code
...

       550 5.7.1 SPF MAIL FROM check failed:
       550 5.7.1 The domain example.com explains:
       550 5.7.1 Please see http://www.example.com/mailpolicy.html

Corrected Text
--------------
if supported, the 5.7.7 enhanced status code
...

       550 5.7.7 SPF MAIL FROM check failed:
       550 5.7.7 The domain example.com explains:
       550 5.7.7 Please see http://www.example.com/mailpolicy.html

Notes
-----
5.7.1 generally refers to messages refused due to content or LOCAL policies.
5.7.7 refers to messages where there is an integrity problem.

5.7.7 is a better description for rejecting an unauthorized message due to the application of automatic checking criterion set by remote validation.

The author of this errata notes that the IANA is showing a pending addition to the enhanced codes to add SPF-specific error code 5.7.23 (in lieu of 5.7.1 or 5.7.7), but currently sees no valid RFC proposing it.  The draft is located at: http://tools.ietf.org/html/draft-ietf-appsawg-email-auth-codes-07

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7208 (draft-ietf-spfbis-4408bis-21)
--------------------------------------
Title               : Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1
Publication Date    : April 2014
Author(s)           : S. Kitterman
Category            : PROPOSED STANDARD
Source              : SPF Update
Area                : Applications
Stream              : IETF
Verifying Party     : IESG

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 13 Aug 2014 19:26:24 -0400

I agree with Scott's argument, but even if I didn't it wouldn't be
correct to do this in an erratum.  It's a substantive change to the
protocol.  It should be rejected.

Best regards,

A

On Wed, Aug 13, 2014 at 07:19:48PM -0400, Scott Kitterman wrote:
> I believe this should be rejected. 
> 
> RFC7208 doesn't specify that messages should be rejected. A decision to reject is a local policy decision. 5.7.1 is the correct code.
> 
> In any case, draft-ietf-appsawg-email-auth-codes updates RFC7208 on this exact question, so the point will shortly be moot anyway. 
> 
> Scott K
> 
> On August 13, 2014 7:07:34 PM EDT, RFC Errata System <[email-masked]> wrote:
> >5.7.7 is a better description for rejecting an unauthorized message due
> >to the application of automatic checking criterion set by remote
> >validation.
> >
> >The author of this errata notes that the IANA is showing a pending
> >addition to the enhanced codes to add SPF-specific error code 5.7.23
> >(in lieu of 5.7.1 or 5.7.7), but currently sees no valid RFC proposing
> >it.  The draft is located at:
> >http://tools.ietf.org/html/draft-ietf-appsawg-email-auth-codes-07
> >
> >Instructions:
> >-------------

-- 
Andrew Sullivan
[email-masked]

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 13 Aug 2014 19:19:48 -0400

Scott K